Privacy policy
Last updated:
This notice covers personal data used by the PostDecode website and browser extension.
Who is responsible
Ilia Menshikov operates PostDecode and is responsible for your personal data. For privacy questions or requests, email admin@postdecode.co.uk.
Personal data we use
- Google account ID, email address and verification status, and your name and profile-picture URL if Google supplies them when you sign in.
- Account and authentication records needed to keep you signed in.
- Postcode searches and listing locations used to provide reports. The extension reads supported listing pages to identify the location.
- IP addresses, request URLs, browser information and error diagnostics. URLs may contain searched postcodes or streets.
- Your email address and message content when you contact us.
Purposes and legal bases
We rely on legitimate interests to provide reports, manage accounts, secure the service, investigate errors and answer messages. You can object to this processing. We also use information where needed to meet legal obligations, including data-protection requests.
Sign-in information is needed for account access; without it, only public demo reports are available. We do not sell personal data, use it for targeted advertising or make automated decisions with legal or similarly significant effects on you.
Cookies and local storage
We use an authentication cookie to keep you signed in, lasting up to 90 days. Sessions expire after 30 days of inactivity or 90 days overall. The extension stores your email and sign-in credentials on your device. Signing out clears these credentials; it does not delete your account.
Recipients and international transfers
Hetzner hosts account records in Germany. Google provides sign-in. Sentry processes error and performance diagnostics in its EU region. Our email provider handles correspondence. We may also disclose personal data when required by law.
Transfers to recipients in the European Economic Area are covered by UK adequacy regulations. Provider support or subcontractors may process data elsewhere. Contact us for details of any other transfers and the protections that apply.
Retention
Account records remain until deleted. Email us to request deletion. Expired or revoked session records are removed during routine sign-in cleanup, rather than immediately on expiry. Server logs rotate by size; diagnostic and backup retention depends on provider settings. Contact us for the applicable periods. We retain correspondence as needed to resolve your request and meet legal obligations.
Your rights
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Email admin@postdecode.co.uk. We may need to verify your identity and normally respond within one month, explaining any lawful extension.
You can also complain to the Information Commissioner's Office, the UK data-protection regulator.